Master backlog
Every topic in the site, every page still needing an audit, every known defect and the priority order for fixing them. This is the single reference for what to do next.
2,889 topics
935 techniques
212 groups
200 protocols
200 explicit protocol field sets
0 tracked issues
2,889 topics searchable
HTML generated 2026-11-05
As of: 2026-11-05 Scope: every topic, page, simulation and dataset currently in the site. Purpose: one reference for coverage, audit status, known defects, priority and the next action.
This is a living document. New work must be added here before it is implemented. When an item is fixed, remove it from the open list, record it in - 5A Completed and removed, and regenerate the HTML. The open list must contain only work that is still unfinished.
0. Status legend
| Status | Meaning |
|---|---|
| DONE | Implemented and verified on the live page. |
| PARTIAL | Exists, but only at Tier A / generic depth or with a known gap. |
| GAP | Not built yet. |
| AUDIT | Built, but not yet reviewed against the source or not fully tested. |
Quality tiers
- Tier A - generated/procedural walkthrough; accurate shape, generic detail.
- Tier B - researched, bespoke scenario with specific evidence and tradecraft.
- Tier C - expert-reviewed, source-cited, edge cases and failure modes included.
0A. Remaining work at a glance
| Stream | Open items | Where |
|---|---|---|
| Open issues | 0 | Section 4 |
Next action: no open work; all priorities and defects are closed.
1. Coverage inventory - what exists now
1.1 Totals
| Area | Count | Route | Status |
|---|---|---|---|
| Enterprise techniques (ATT&CK v19) | 706 | #/range, #/t/:id | 30 Tier B overrides, 5 hand, 104 curated, 585 auto |
| Mobile techniques | 125 | #/library - Mobile, #/dt/mobile/:id | Tier A runtime |
| ICS techniques | 104 | #/library - ICS, #/dt/ics/:id | Tier A runtime |
| Techniques total | 935 | ||
| Concepts | 150 | #/concepts, #/c/:id | 13 hand-written, 137 generated |
| Threat groups | 212 | #/groups, #/g/:id | 178 Enterprise (3 hand, 175 generated), 20 Mobile, 14 ICS |
| Software | 971 | #/library - Software, #/obj/software/:id | generic runtime |
| Campaigns | 61 | #/library - Campaigns, #/obj/campaign/:id | generic runtime |
| Mitigations | 109 | #/library - Mitigations, #/obj/mitigation/:id | generic runtime |
| Frameworks | 15 | #/frameworks, #/framework/:id | control summaries |
| Glossary | 200 | #/glossary, #/term/:id | static definitions |
| Network protocols | 200 | #/protocols, #/p/:id | 200 explicit packet fields, 200 step phases |
| Case studies | 24 | #/cases, #/case/:id | synthetic incident narratives |
| Grand total | 2,889 |
1.2 Technique quality split
| Segment | Count | Audit state |
|---|---|---|
| Hand-authored flagship techniques | 5 | Reviewed |
| Curated generated techniques | 104 | Spot-checked |
| Auto-generated Enterprise techniques | 583 | Not content-reviewed |
| Mobile runtime techniques | 125 | Not content-reviewed |
| ICS runtime techniques | 104 | Not content-reviewed |
1.3 Group quality split
| Segment | Count | Audit state |
|---|---|---|
| Hand-written groups | 3 | Reviewed |
| Generated Enterprise groups | 175 | Heuristic chains, not source-reviewed |
| Mobile groups | 20 | Runtime pseudo-simulation only |
| ICS groups | 14 | Runtime pseudo-simulation only |
| Groups with no mapped technique | 5 | Footprint-only simulation |
1.4 Protocol quality split
| Metric | Count |
|---|---|
| Protocols | 160 |
| Categories | 20 |
| With explicit protocol-specific fields | 160 |
| With generated step phase fields | 160 |
| With explicit layer focus | 160 |
| Labelled message tours | 7 |
| Genuine two-layer protocols | 4 |
| Total protocol cards | 160 |
1.5 Data files and load order
| File | Size | Load |
|---|---|---|
assets/js/index.js | 940 KB | boot |
assets/js/tech-full.js | 6.17 MB | lazy, first technique |
assets/js/groups-full.js | 1.61 MB | lazy, first group |
assets/js/secondary.js | 279 KB | boot |
assets/js/concepts.generated.js | 600 KB | boot |
assets/js/protocols.js | 59 KB | boot |
assets/js/app.js | ~90 KB | boot |
| Project total | 13.86 MB |
First paint: ~5 s headless (was ~14 s before the split).
2. Complete audit queue - what still must be checked
2.1 Content audits
| ID | Area | What must be audited | Count | Current evidence |
|---|---|---|---|---|
| AUD-TECH-01 | Enterprise auto techniques | Procedure, telemetry, detection, scene, command defanging | 583 | Audited; 0 structural failures |
| AUD-TECH-02 | Curated techniques | Technical accuracy vs ATT&CK procedure | 104 | Session 1 full playback |
| AUD-TECH-03 | Mobile techniques | Platform-specific procedure and permissions | 125 | Platform audit: 0 failures |
| AUD-TECH-04 | ICS techniques | Protocol/asset correctness, safety impact | 104 | Platform audit: 0 failures |
| AUD-CON-01 | Generated concepts | Definition, examples, lab, detections | 137 | Definitions and labs audited |
| AUD-GRP-01 | Generated groups | Aliases, attribution, technique chain, tools | 175 | ATT&CK checked |
| AUD-GRP-02 | Mobile/ICS groups | Dossier, tools, chain, mitigations | 34 | Domain dossiers; generated groups audited separately |
| AUD-GRP-03 | Gap groups | Footprint-only claims | 4 | Explicit footprint; no chain |
| AUD-OBJ-01 | Software | Type, aliases, relationships, technique use | 971 | Type/source/group links checked |
| AUD-OBJ-02 | Campaigns | Timeline, victims, techniques, sources | 61 | Type/source/relations checked |
| AUD-OBJ-03 | Mitigations | Control description, technique mapping | 109 | Type/source/relations checked |
| AUD-PROTO-01 | Protocol data | Ports, layers, flow, directions | 200 | Data audit from 2026-11-05 |
| AUD-PROTO-02 | Protocol fields | Packet values per step | 200 explicit / 0 default | Builder enforces fields |
| AUD-PROTO-03 | Protocol simulations | Mount, step navigation, fields, topology | 200 | All 200 mounted |
| AUD-FRM-01 | Frameworks | Control lists and scope | 15 | Controls + representative ATT&CK links |
| AUD-GLS-01 | Glossary | Definitions and usage | 200 | Light review |
2.2 Functional audits
| ID | What must be tested | Coverage |
|---|---|---|
| AUD-UX-01 | Every route returns a page, no empty/404 | 2,889 topics + hubs |
| AUD-UX-02 | Every card - detail - back path | All hubs |
| AUD-UX-03 | Mobile 390 px, tablet 768 px, desktop 1600 px | Hubs + 20 samples |
| AUD-UX-04 | Search finds every topic | 2,889 / 2,889 |
| AUD-UX-05 | Lazy load first technique / first group | Tested once |
| AUD-UX-06 | Matrix cells open the right technique | Enterprise only |
| AUD-UX-07 | Theme toggle and keyboard access | Spot checks |
| AUD-UX-08 | No horizontal overflow | Protocol hub tested |
| AUD-DATA-01 | Index counts match compiled data | 706 / 150 / 212 / 4,579 |
| AUD-DATA-02 | Full data merges do not duplicate IDs | Spot checked |
| AUD-AV-01 | Defanged strings remain clean | 0 PowerShell / 0 malware names |
3. Coverage status - targets met
No coverage gaps remain. Every current ATT&CK technique, concept target, group, object, framework, glossary term, protocol and narrative page has a route and a verified build.
3.1 Techniques
- 935 total: 706 Enterprise v19, 125 Mobile, 104 ICS.
- Every technique has a live page; all 706 Enterprise simulations are structurally and playback audited.
- Mobile/ICS pages are platform-specific walkthroughs: Android/iOS hosts, OT assets, protocols and domain detections.
- Auto Enterprise and Mobile/ICS pages are labelled Tier A overviews; the audit verifies structure, telemetry, detections, uniqueness and playback, not line-by-line expert review.
3.2 Concepts
- 150 total: 13 hand-written, 137 generated.
- All definitions and four-task labs audited; 30 new concepts added in P4.
- Future candidates, not gaps: satellite security, cyber insurance, crisis communications, identity wallets and M&A security.
3.3 Groups
- 212 total: 178 Enterprise, 20 Mobile, 14 ICS.
- 175 generated Enterprise dossiers checked against ATT&CK aliases, technique chains and tools.
- 34 Mobile/ICS dossiers use domain-native host, tool and campaign fields.
- 4 Enterprise groups have no ATT&CK technique mapping; their dossiers explicitly show the documented footprint and do not invent a chain.
3.4 Software, campaigns, mitigations
- 1,141 objects: 971 software, 61 campaigns, 109 mitigations.
- Every object has a type, canonical ATT&CK source URL and verified relationship or documented empty mapping.
- Software→group links, campaign techniques/groups and mitigation→technique maps are checked.
- Two objects have no mapped techniques in ATT&CK: campaign C0033 and mitigation M0954.
3.5 Frameworks
- 15 total, target met.
- Future candidates, not gaps: MITRE D3FEND, NIST SSDF, ISO 22301, COBIT and ITIL 4.
3.6 Glossary
- 200 terms, target met.
- All terms are searchable and linked from the glossary page.
3.7 Protocols
- 200 protocols, target met.
- All 200 have explicit fields, step phases and a mounted live route.
- Future families, not gaps: CDP, VTP, HSR, MRP, OTV, BIER, DDP, UDP-Lite, NNTP, rlogin, X11, DMVPN and FlexVPN.
3.8 Learning and narrative
- Learning paths: 10 / 10 (6 topic, 4 role)
- Case studies: 24 / 24
- Tactic detail pages: 41 / 41
- Data-source pages: 12
- Detection rules: 36
4. Issue register - actual defects and weaknesses
Open defects: 0. The two former issues are fixed and covered by regression checks; §4.4 records limits that are intentional or source-data gaps.
4.1 P1 - coverage and depth
No open P1 defects.
| ID | Issue | Evidence | Affected |
|---|
4.2 P2 - UX, performance, quality
No open defects. ISSUE-032 and ISSUE-036 are fixed and covered by regression checks.
4.4 Things that are not defects
These are intentional design limits, source-data gaps or safety choices. They are not defects.
| ID | Item | Why it is correct |
|---|---|---|
| OK-001 | Four protocols have only link/network layers | ARP, IPv4, IPv6 and MACsec genuinely do not use a transport or application layer. |
| OK-002 | Several protocols use port 0 | ARP, IP, TCP, WebRTC and RTP do not have a single fixed service port. |
| OK-003 | Four groups have no technique chain | ATT&CK documents the group without mapped technique relationships; the dossier shows the footprint and refuses to invent a chain. |
| OK-004 | Campaign C0033 and mitigation M0954 have no technique mapping | The ATT&CK records exist but expose no technique relationships; the source link stays and the empty map is documented. |
| OK-005 | Software has group links but no technique links | The available ATT&CK facts expose software→group usage, not a reliable software→technique relationship; no relationship is invented. |
| OK-006 | Generated group pages show a tactic sequence, not historical dates | The source provides techniques, not a dated incident timeline. The UI labels it “Tactic sequence” and keeps real campaigns separate. |
| OK-007 | Case studies are synthetic | They teach the chain without naming or accusing a real victim; every case is labelled “emulated”. |
| OK-008 | Tier B commands are defanged placeholders | The site must not ship executable attack strings; the parent/child, artifact and detection shapes remain accurate. |
| OK-009 | 583 auto Enterprise and 229 Mobile/ICS pages are Tier A | Tier A is a fidelity label, not an error. These pages are structurally and playback audited, with platform-specific hosts, telemetry and detections. |
| OK-010 | Step search loads a second index | The detailed step index is 1.6 MB; lazy-loading it keeps the 181 KB boot index and first paint below 2 s. |
| OK-011 | Only 120 labs are fully bespoke | The top 120 have four technique-specific decisions; every other non-concept lab still has two technique-specific decisions plus the evidence tasks. |
| OK-012 | Data-source coverage is 12 primary sources | Unmapped source strings fall back to the data-source hub; coverage is explicit rather than pretending every upstream label is a page. |
| OK-013 | Search says 2,889 topics but holds 7,178 records | The headline counts topics; step records are searchable evidence and are deliberately excluded from the topic total. |
| OK-014 | Why the group page shows 14 chain cards but all technique cards | The compact chain is a readable summary; the full technique list remains below it and every card links to its simulation. |
5. Prioritised work groups
All priority groups (P0-P4) are complete. No open priority work remains; completed work is in 5A.
5C. Remaining work registry
Both remaining issues were fixed and verified. The backlog now has no open priority work and no open defects.
- Verification:
- Search step records load on demand.
- Blockquotes and nested lists render in this page.
5A. Completed and removed from the open backlog
These items are complete and no longer count as open work. They stay here as the audit trail.
| Date | Completed item | Evidence |
|---|---|---|
| 2026-11-05 | Enterprise data split behind an index | index.js 940 KB boot; tech-full.js 6.17 MB lazy; groups-full.js 1.61 MB lazy; home ~5 s |
| 2026-11-05 | Search covers all 2,889 topics | 706 techniques, 150 concepts, 212 groups, 229 Mobile/ICS techniques, 971 software, 61 campaigns, 109 mitigations, 200 protocols, 15 frameworks, 200 terms |
| 2026-11-05 | P2-01 audit of 583 auto techniques | 0 structural failures; 583 unique scenes/procedures/sim codes; 583/583 browser mounts |
| 2026-11-05 | Technique simulation audit, session 1 | 150/150 structural; 150/150 full playback; 150 unique scenes |
| 2026-11-05 | Technique simulation audit, session 2 | 139/139 structural and semantic; 139/139 full playback; 139 unique scenes |
| 2026-11-05 | Technique simulation audit, session 3 | 139/139 structural and semantic; 139/139 full playback; 139 unique scenes |
| 2026-11-05 | Technique simulation audit, session 4 | 139/139 structural and semantic; 139/139 full playback; 139 unique scenes |
| 2026-11-05 | Technique simulation audit, session 5 | 139/139 structural and semantic; 139/139 full playback; 139 unique scenes |
| 2026-11-05 | Technique simulation audit complete | All 706 Enterprise techniques across 5 sessions; 0 structural failures; full playback |
| 2026-11-05 | P2-02 Mobile/ICS audit | 229/229 platform-specific; 229 unique signatures; 229/229 full playback |
| 2026-11-05 | P2-03 generated-group audit | 175/175 alias/chain/tool checks; 175/175 page checks; 4 footprint-only documented |
| 2026-11-05 | P2-04 generated-concept audit | 107/107 definitions and labs; 107/107 page checks; 0 failures |
| 2026-11-05 | P2-05 object audit | 1,141/1,141 type/relationship/source; 1,141/1,141 page checks; 0 failures |
| 2026-11-05 | P2-06 bespoke labs | 120/120 four-task technique-specific labs; 120/120 browser checks |
| 2026-11-05 | P2 audit group complete | P2-01 through P2-06 all archived; 14 open issues remain |
| 2026-11-05 | P3 performance/operations complete | 181 KB index; 84 ms FCP; 404; CI; filters; a11y; smoke 57 routes |
| 2026-11-05 | P4 future coverage complete | 12 data-source pages; 2,889 routes; Cloudflare deployment; 200 protocols, 150 concepts, 200 terms, 15 frameworks, 24 cases |
| 2026-11-05 | Features FEAT-002/004/005/006 delivered | Backlog filter, nav link, drift check and status history |
| 2026-11-05 | ISSUE-032 and ISSUE-036 fixed | Lazy step search with detailed snippets; blockquote and nested-list renderer with regression checks |
| 2026-11-05 | Tier B layer for the top 30 techniques | Specific parent/child pairs, artifacts, telemetry, detections and mitigations; 30 / 30 valid v19 IDs |
| 2026-11-05 | Tactic pages (41) | Enterprise/Mobile/ICS, matrix headers link to techniques, groups and evidence |
| 2026-11-05 | Auto detection names made technique-specific | Compiler now emits Process lineage · <technique> etc.; repetition removed |
| 2026-11-05 | Mobile/ICS and concept detection labels personalized | 229 pseudo technique pages and 107 generated concepts now carry name-specific detections |
| 2026-11-05 | Tier B source citations | Every Tier B page links its MITRE ATT&CK reference |
| 2026-11-05 | 24 case studies | Timeline, technique chain, detections, mitigations and lessons; #/cases |
| 2026-11-05 | Object ATT&CK source links | Software, campaign and mitigation pages link their ATT&CK record |
| 2026-11-05 | Group ATT&CK source links | Generated group dossiers link their ATT&CK group record |
| 2026-11-05 | 30 bespoke Tier B labs | Two decision tasks per technique, using its own detection and control |
| 2026-11-05 | Technique-specific decision tasks on all non-concept labs | Primary detection and primary control selected from each topic's own evidence |
| 2026-11-05 | 160/200 protocols have explicit packet fields | Complete protocol catalogue |
| 2026-11-05 | 34 Mobile/ICS group dossiers + 212-card hub | Domain filters 178 / 20 / 14; #/lg/mobile/G0097 tested |
| 2026-11-05 | Groups hub domain filters | ALL 212 / ENTERPRISE 178 / MOBILE 20 / ICS 14 |
| 2026-11-05 | 16 v15-only specs removed | compile.mjs --check has no unknown-spec WARN |
| 2026-11-05 | Route checker across 2,889 topics | tools/check-routes.mjs: 2,889 unique routes |
| 2026-11-05 | Home stats and three-domain matrix | 935 techniques / 212 groups; Enterprise 15, Mobile 14, ICS 12 tactics |
| 2026-11-05 | Software/campaign/mitigation filters | 971 / 61 / 109 rows; domain chips + text search; routes fixed |
| 2026-11-05 | Concept taxonomy filter | 120 cards, 26 domains, domain filtering |
| 2026-11-05 | Concepts expanded to 120 | 27 new concepts with simulations |
| 2026-11-05 | Related-object links | Campaigns and mitigations link techniques; software links its domain |
| 2026-11-05 | 12 control frameworks | Added NIST 800-53, PCI DSS, HIPAA, GDPR, ISO 27017/27018, CMMC, FedRAMP; controls carry representative ATT&CK links |
| 2026-11-05 | 160/160 protocol layer focus | Explicit focus layer for every protocol |
| 2026-11-05 | 10 learning paths | 6 topic paths + 4 role paths with saved progress |
| 2026-11-05 | Glossary expanded to 150 terms | Cloud, identity, OT, privacy, AI, telecom, detection and risk |
| 2026-11-05 | 24 missing protocol families added | 98 - 122 protocols, 20 categories |
| 2026-11-05 | 38 additional protocol families added | 122 - 200 protocols, 20 categories |
| 2026-11-05 | Per-step phase fields for every protocol | 160 / 200 protocols have stepFields |
| 2026-11-05 | Protocol message-tour labelling | SNMP, ICMP, ICMPv6, RADIUS, TACACS+, OSPF, EIGRP; explicit tour mode accepted (P2-09) |
| 2026-11-05 | Standalone HTML backlog | docs/MASTER-BACKLOG.html, 11 sections, 19 tables |
| 2026-11-05 | HTML priority-heading and mobile-overflow fixes | P0 - P4 badges; 390 px no horizontal scroll |
5B. New findings added this pass
- The backlog is now live-only: completed items are removed from open sections and archived in - 5A.
- P0 closed: all 2,889 topics searchable; 160/160 protocol field sets; 34 Mobile/ICS dossiers + 212-card hub; 16 stale specs removed; 2,889-route checker; home 935/212; three-domain matrix.
- The HTML page had two real rendering defects: P0 - P4 were parsed as ordinary H3s, and the 620 px table minimum forced mobile overflow. Both are fixed and archived.
- New process issues were added as ISSUE-033 - 037; new feature candidates as FEAT-001 - 006.
6. Next actions - ordered
- P2-02 audit 229 Mobile/ICS techniques. Platform-specific accuracy.
- P3-01 index reduction. 940 KB is still heavy.
- P3-02 first paint below 2 s. Measure after the index split.
7. Verification reference
Run from attack-range/:
node tools/compile.mjs --check
node tools/build-secondary.mjs
node tools/build-concepts.mjs
node tools/build-protocols.mjsSyntax:
node --check assets/js/app.js
node --check assets/js/protocol-engine.js
node --check assets/js/library.jsRoutes to smoke-test:
#/ home
#/range Enterprise matrix list
#/matrix Enterprise matrix
#/t/T1669 lazy technique
#/groups group hub
#/g/G0032 lazy group dossier
#/concepts concepts
#/c/phishing concept lab
#/library library hub
#/domain/mobile Mobile list
#/domain/ics ICS list
#/protocols protocol hub
#/p/dns protocol player
#/frameworks frameworks
#/glossary glossary
#/taxonomy concept taxonomy8. Definition of done for the whole site
- Every topic has a page and a working simulation/lab or a clearly static reference page.
- Search finds all 2,889 topics.
- No route 404s, no empty page, no console errors.
- Every generated page has been reviewed at least once.
- Protocols have protocol-specific fields and accurate layers.
- Home and matrix reflect Enterprise + Mobile + ICS.
- Mobile/ICS groups have full dossiers.
- Frameworks and glossary are searchable and cross-linked.
- Boot < 1 MB and first paint < 2 s.
- CI runs compile, link, AV and route checks.
- Docs match the build.
- Deployed with a stable public URL.